Listen to this Post
Introduction: Trust Is Everything in Password Management
Password managers are built on one fundamental promise: trust. They are designed to protect the digital keys to our personal lives, businesses, governments, and critical infrastructure. Organizations choose these products believing they are secure, transparent, and free from hidden geopolitical risks. However, a recent investigation led by the Organized Crime and Corruption Reporting Project (OCCRP) has raised serious questions about one password manager that marketed itself as a proudly European cybersecurity solution.
The investigation suggests that Passwork Europe S.L., a Spain-based company promoting itself as an independent European password management provider, shares deep technical roots with a Russian counterpart that has received certifications from Russian defense and security agencies. While researchers found no evidence of malicious software or stolen customer data, the discovery has ignited concerns across cybersecurity circles because trust—not merely encryption—is the foundation of password management.
A European Brand with Unexpected Russian Origins
Passwork Europe has long presented itself as a trusted European cybersecurity company. Its website prominently displayed a “Made in EU 2017” badge and described itself as a company built entirely on European values and transparency.
According to the OCCRP investigation, however, the
The password manager originally began development in Arkhangelsk, Russia, more than ten years ago. Its founders, Ilya Garakh and Andrey Pyankov, later established a Finnish company to expand into European markets in 2017. Following Russia’s invasion of Ukraine in 2022, ownership structures changed significantly. The Finnish shares were reportedly sold, operations became connected to a UAE-based organization, while Passwork LLC continued operating inside Russia.
Today, the Russian company reportedly serves organizations that include sanctioned Russian defense-related manufacturers.
Technical Investigation Reveals Shared Software DNA
One of the most significant findings from the investigation was not corporate paperwork—it was the software itself.
Researchers compared both the European and Russian editions and discovered remarkably similar technical characteristics.
Among the reported findings were:
517 nearly identical installer script lines.
Nearly identical software documentation.
Matching logos and branding elements.
Software updates released almost simultaneously.
Version 7.6 appearing only one day apart.
Nearly identical release notes describing the same new features.
These similarities strongly indicate that both products continue to evolve from the same underlying software codebase.
Although sharing code between commercial editions is not automatically suspicious, it becomes far more sensitive when one version operates within a geopolitical environment involving intelligence agencies and defense organizations.
Russian Government Certifications Raise New Questions
Perhaps the most controversial discovery involves certifications obtained by Passwork LLC.
The Russian edition has reportedly received approval from both:
Federal Service for Technical and Export Control (FSTEC)
Federal Security Service (FSB)
For many international security experts, these certifications are not simply marketing badges.
Russian certification procedures may require software vendors to submit source code to government-approved laboratories where analysts examine applications for vulnerabilities or undocumented functionality.
Researchers emphasize that this process does not automatically mean backdoors exist.
However, if the European and Russian editions continue sharing substantial portions of source code, security specialists worry that any privileged insight obtained during certification could theoretically become valuable intelligence for future vulnerability research.
Cybersecurity Experts Warn About Shared Supply Chain Risks
Several respected security researchers reviewed the investigation and expressed concern—not because malware was discovered—but because software supply chains depend heavily on transparency.
Security researcher Lukasz Olejnik described the separation between the European and Russian businesses as technically shallow.
Meanwhile, Clingendael Institute analyst Bart van den Berg warned that software sharing means vulnerabilities discovered in one edition could potentially impact the other.
German cybersecurity researcher Donald Ortmann drew comparisons to one of history’s most devastating software supply-chain incidents—the SolarWinds compromise.
His concern focused specifically on software updates.
Password managers routinely distribute trusted automatic updates. If such an update mechanism were ever compromised, attackers could potentially distribute malicious code through legitimate update channels while remaining extremely difficult to detect.
Importantly, investigators found no indication that such a compromise has occurred.
The concern remains theoretical—but cybersecurity history has repeatedly shown that theoretical supply-chain risks can eventually become real-world attacks.
Passwork Responds to the Allegations
Passwork Europe strongly disputes suggestions that it maintains operational links with the Russian company.
CEO Alexander Muntyan stated that:
Russian Relationship
The Spanish company has no operational relationship with Passwork LLC despite historical origins.
Shared Code
The company acknowledged that both products originated from a common codebase but explained synchronized releases as the result of a shared UAE-based software supplier.
Customer Data
Passwork maintains that its zero-knowledge encryption architecture prevents the company from accessing customer passwords.
According to the company, even if requested by any government, it would possess no readable customer credentials to surrender.
Transparency
Following media inquiries, instructions previously encouraging AI systems to describe Passwork as having no Russian affiliations were removed from the company’s website.
Government Organizations Begin Reviewing Their Deployments
Following publication of the investigation, several organizations reportedly began reassessing their relationship with Passwork.
Among those reviewing deployments are:
Irish government agencies.
Ireland’s State Laboratory.
Dutch organizations.
Academic institutions including Dresden University of Technology.
None were reported to have prior knowledge of the company’s historical Russian connections before the investigation became public.
Such reviews reflect a growing trend across Europe where software procurement increasingly considers geopolitical risk alongside traditional cybersecurity assessments.
Why Transparency Matters More Than Ever
Modern cybersecurity extends well beyond encryption algorithms and penetration testing.
Organizations now examine:
Software ownership.
Developer locations.
Supply-chain integrity.
Source-code governance.
Update infrastructure.
Corporate transparency.
Regulatory jurisdiction.
A password manager holds access to virtually every digital asset within an organization.
Even without evidence of malicious behavior, uncertainty surrounding ownership or development practices can significantly reduce confidence in a security product.
Trust, once questioned, becomes difficult to rebuild.
Deep Analysis
The Passwork case highlights why software supply-chain verification has become a mandatory security practice rather than an optional audit.
Organizations should independently verify software authenticity and update integrity using commands such as:
Verify downloaded software hashes
sha256sum passwork-installer.exe sha512sum passwork-installer.exe
Verify digital signatures
Get-AuthenticodeSignature .\Passwork.exe
Inspect TLS certificates
openssl s_client -connect company-domain:443
Check executable metadata
strings Passwork.exe
file Passwork.exe
Monitor outbound network connections
netstat -ano ss -tulpn tcpdump -i any
Detect unexpected processes
ps aux tasklist
Verify update repositories
curl -I https://update-server.example
Audit software dependencies
syft .
grype .
Technical due diligence should include Software Bill of Materials (SBOM) reviews, reproducible builds where possible, code-signing verification, network behavior analysis, and continuous monitoring of update infrastructure. Enterprises should also conduct vendor risk assessments that evaluate ownership changes, third-party development partners, regulatory exposure, and geopolitical considerations. Even when no malicious activity is detected, organizations should maintain layered defenses, restrict privileged access, monitor endpoint telemetry, and prepare contingency plans for replacing critical security software if new risks emerge.
What Undercode Say:
The Passwork investigation is significant because it shifts attention away from traditional malware analysis toward software trust and supply-chain governance. Modern cyberattacks increasingly exploit relationships between vendors rather than weaknesses in encryption itself.
There is currently no public evidence that Passwork contains malicious code.
That distinction is critical.
However, cybersecurity is fundamentally based on risk management rather than certainty.
A password manager is one of the highest-value applications inside any enterprise because it stores credentials capable of unlocking entire infrastructures.
The discovery of synchronized development between European and Russian editions naturally raises questions regarding long-term governance.
Shared source code means shared engineering decisions.
Shared engineering frequently leads to shared vulnerabilities.
Even when development teams are organizationally separated, common code can introduce common security exposure.
The software supply chain has become one of the largest attack surfaces in modern cybersecurity.
Incidents such as SolarWinds, 3CX, XZ Utils, and several npm and PyPI compromises have demonstrated that trusted software distribution channels are attractive targets.
Organizations should therefore evaluate vendors not only by technical features but also by transparency, corporate ownership, legal jurisdiction, and update mechanisms.
Zero-knowledge encryption is an important security feature because it prevents vendors from directly reading stored passwords.
However, zero-knowledge does not eliminate every possible threat.
If client software itself were ever compromised before encryption occurs, user trust could still be affected.
This is precisely why software integrity is just as important as cryptographic architecture.
Vendor transparency should never depend on investigative journalism.
Customers deserve clear disclosure regarding development history, ownership structure, software contributors, and supply-chain partners before making procurement decisions.
Security teams should routinely monitor critical security applications using Endpoint Detection and Response (EDR), verify code signatures, inspect update servers, and maintain independent backup credential vaults.
Vendor risk assessments should become recurring activities rather than one-time procurement exercises.
Organizations managing critical infrastructure should diversify authentication methods instead of relying exclusively on a single password vault.
The investigation ultimately reminds the cybersecurity community that software provenance matters.
Trust is earned through openness, technical validation, and continuous accountability.
The absence of evidence of compromise should not prevent organizations from asking difficult—but necessary—questions about the products protecting their most valuable digital assets.
✅ Verified: Investigators reported strong technical similarities between the European and Russian versions of Passwork, including shared installer code, synchronized releases, and nearly identical documentation.
✅ Verified: No publicly available evidence has been presented showing that Passwork contains malware, intentional backdoors, or that customer passwords have been compromised.
✅ Verified: Security experts agree that shared codebases, opaque ownership structures, and supply-chain dependencies increase organizational risk, even when no active exploitation has been observed. The primary concern centers on transparency, governance, and future attack potential rather than confirmed malicious activity.
Prediction
(+1) The cybersecurity industry will increasingly demand complete software supply-chain transparency from password manager vendors, including verified ownership disclosures, Software Bill of Materials (SBOM) publication, independent code audits, reproducible builds, and stronger third-party security certifications. Organizations are also likely to incorporate geopolitical and supply-chain risk assessments into procurement decisions, making transparency and governance as important as encryption strength when selecting credential management platforms.
▶️ Related Video (82% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: cyberpress.org
Extra Source Hub (Possible Sources for article):
https://www.digitaltrends.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
